Attorney General Phil Weiser launches enforcement of Colorado Privacy Act

July 12, 2023 (DENVER, CO) – Attorney General Phil Weiser announced through a series of letters to businesses, sent this week, that the Colorado Department of Law will begin enforcing the recently enacted Colorado Privacy Act. The new data privacy law went into effect on July 1.

“As I’ve said publicly throughout the process, this Department’s enforcement of the Colorado Privacy Act is a critical tool to protect consumers’ data and privacy. Our enforcement of this important law will not seek to make life challenging for organizations that are complying with the law, but rather will seek to support such efforts,” said Weiser. “These letters will help make businesses aware of the law and direct them to educational resources to help them comply. And, if we become aware of organizations that are flouting the law or refusing to comply with it, we are prepared to act.”

The initial round of letters will focus on educating companies that operate in Colorado on their new legal obligations. There is particular emphasis on obligations relating to the collection and use of sensitive data, including the requirement to obtain consumer consent prior to collecting sensitive data, and the obligation to allow consumers to opt out of targeted advertising and profiling.

Department staff worked closely with industry, nonprofits, consumer advocates, and others over the last year to develop the law’s regulations, including allowing for substantial public comment from businesses, nonprofits, and consumers across the country.

The Colorado Privacy Act applies to entities that operate in Colorado or target Colorado citizens and, annually, either collect more than 100,000 individuals’ data, or receive revenue or otherwise benefit from the sale of personal data and process the personal data of more than 25,000 persons.

Covered entities are required to comply with new obligations regarding consumer data, including but not limited to:

  • Providing consumers with clear, understandable, and transparent information about how and why they collect, store, use, share, and sell personal data;
  • Responding to consumer requests to access, delete, correct, and get a portable copy of their personal data;
  • Allowing consumers to opt out of the sale of personal data as well as targeted advertising and certain kinds of profiling;
  • Obtaining consent before collecting or using sensitive data; and
  • Only collecting the minimum amount of personal data necessary from consumers.

The law only applies to Colorado residents while acting in an individual or household capacity (e.g., when browsing the internet or signing up for a retail rewards program) and does not apply to data collected in an employment context.

For more information about the Colorado Privacy Act’s new rights and responsibilities, including an FAQ and informational webinars for consumers and organizations, please visit www.coag.gov/cpa

###